bump vulnerable packages

package.json

@@ -24,19 +24,20 @@
     "browserify": "14.4.0",
     "chai": "^3.5.0",
     "concurrently": "^3.1.0",
-    "coveralls": "^2.11.15",
+    "coveralls": "^3.0.2",
     "eslint": "^3.12.1",
     "istanbul": "^0.4.5",
-    "karma": "^1.3.0",
+    "karma": "^3.0.0",
     "karma-chai": "^0.1.0",
     "karma-mocha": "^1.3.0",
     "karma-phantomjs-launcher": "^1.0.2",
     "karma-sinon": "^1.0.5",
-    "mocha": "^3.2.0",
+    "mocha": "^5.2.0",
     "mocha-lcov-reporter": "^1.2.0",
     "rimraf": "^2.5.4",
     "sinon": "^1.17.6",
-    "sinon-chai": "^2.8.0"
+    "sinon-chai": "^2.8.0",
+    "xo": "^0.23.0"
   },
   "main": "./src/index.js",
   "browser": "./src/browser.js"